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Abstract: We present a fiber-based continuous-variable quantum key 
distribution system. In the scheme, a quantum signal of two non-orthogonal 
weak optical coherent states is sent through a fiber-based quantum chan- 
nel. The receiver simultaneously measures conjugate quadratures of the 
light using two homodyne detectors. From the measured Q-function of 
the transmitted signal, we estimate the attenuation and the excess noise 
caused by the channel. The estimated excess noise originating from the 
channel and the channel attenuation including the quantum efficiency 
of the detection setup is investigated with respect to the detection of 
effective entanglement. The local oscillator is considered in the verifica- 
tion. We witness effective entanglement with a channel length of up to 2 km. 
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1. Introduction 

"Kerckhoffs' principle" UJ and Shannon's assumption "The enemy knows the system" 13 es- 
tablished the basis for modern cryptography and enhanced secure communication between two 
parties. With the proposal of the "one time pad" Q, the security aspect shifted from secure 
communication to secure key distribution between these two parties. Quantum key distribu- 
tion (QKD), first proposed 1984 0), offers a way to exchange a secret key using the quantum 
mechanical properties of light as the carrier of information. The security is thereby based on 
fundamental physical concepts. 

First proof of principle experiments for QKD J5] |7) were followed by practical im- 
plementations over long and extremely long distances [8] [9] [TD] [Til . In parallel to these 
discrete-variable QKD systems, continuous-variable QKD using homodyne detection was pro- 
posed 1121 . It was shown, that the limit of 3dB channel attenuation can be overcome by 
the concept of postselection lfl3l and the postprocessing method reverse reconciliation tl4\ . 
Continuous-variable QKD has been tested on quantum channels of up to 25km length ifTBI [161 
using homodyne detection and basis switching. Besides using a single homodyne detection, also 
simultaneous detection of both conjugate quadratures of the signal was demonstrated IfTTl [T81 . 
Homodyne detection of conjugate quadratures referred to as heterodyne detection is particularly 
interesting for three reasons: 

• Random numbers are not needed in the receiver's setup. 

• The Trojan-horse attack [19], where Eve gains information by reading the basis choice 
in Bob's setup, is not possible. 

• The heterodyne detection strategy achieves higher secure bit rates than schemes with 
homodyne detection in some QKD protocols ll20l I2T1 l22l . 

Experiments using heterodyne detection on a long fiber channel, however, had not yet been 
demonstrated. 

In this paper, we present a fiber-based QKD-system using a double-homodyne detection 
setup. As in previous experiments |fT7ll23l , we use binary encoded continuous-variable quan- 
tum states consisting of a signal mode and a local oscillator mode. We adapt our previous 
polarization-based experiments to a fiber channel. To this end, our two mode states are sent 
through the quantum channel using a combination of time lfl5l and polarization multiplex- 
ing lfl6l of signal and local oscillator (LO). Therefore, detrimental effects from photon-phonon 
interactions (GAWBS) are avoided [24||. By describing the sent quantum information in the 
Stokes space 11251 , it is possible to verify effective entanglement in the measurement data ac- 
cording to the method in 1126*1 . In contrast to all previous experiments, not only the signal but 
also the strong reference beam (LO) is considered in this security analysis. We show how to 
measure conjugate Stokes parameters with a freely drifting interferometric phase. The phase 
drift is monitored by additional classical calibration pulses on the quantum channel. Subse- 
quently, Bob remaps his measurement data, similar to |fT6l . Finally, monitoring the intensity of 
the local oscillator at the detection stage allows us to unambiguously demonstrate the genera- 
tion of quantum-correlated data. 

The paper is organized as follows. In Section [2] we introduce our protocol and the Stokes 
formalism. In Section [3] we describe the setup focusing on the implementation of the detec- 
tion part. In Section @] noise characteristics of the system and the transmitted signal states are 
presented. Finally, the entanglement criterion is applied. 




Fig. 1. (left) Schematics of the QKD setup, (right) the detection part is a random phase 
heterodyne detection using the polarization degree of freedom. Our scheme is similar to a 
technique called linear optical sampling 127 1 . In contrast to their system, we have a shot 
noise limited detection and a SNR improvement of about 40 dB. 



2. The protocol 

Our protocol is a continuous-variable adaptation of the two-state protocol proposed by Ben- 
nett |[28l . Alice wishes to share a random bit string with Bob and starts by encoding binary 
information in the phase of coherent states. These two signal states \a) and | — a) are transmit- 
ted through a quantum channel and evolve to the output states po and p\, which are detected by 
Bob in a heterodyne setup. Bob records the expectation values and variances of two orthogonal 
quadratures, which allows him to reconstruct a bit value from each signal and to estimate the 
information potentially extracted by an eavesdropper. A detailed account of the classical data 
processing necessary to distill a secret key from the raw measurement outcomes is presented in 
Ref. HD. 

This two-state protocol is attractive from an experimental point of view, since the signal 
preparation is the simplest possible. Theoretically, lower bounds on the achievable secret key 
rate have been evaluated in Ref. |29l . Unfortunately, those results are not applicable to practical 
scenarios, since the key rate drops too quickly with increasing excess noise. The theory needs 
further development to make the protocol more robust against noise. 

Here, we show that our experiment can establish quantum correlations in the classical data 
held by Alice and Bob, which is a necessary precondition for the distillation of a secret key |30 j. 
The existence of quantum correlations is proven through the verification of so-called effective 
entanglement BTI . a theoretically constructed, alternative description of the signal source. In 
this description, Alice prepares bipartite states 

|^) AB = ^(|0) A |a) B + |l) A |-a) B ). (1) 

Her subsequent orthogonal projective measurements {|0) A (0|, 11)^(11} effectively prepare the 
signal states | ± Ol)b, with equal probability. The action of the quantum channel on the state 
\ x ¥)ab leads to an effective bipartite quantum state Pab shared by Alice and Bob. It is their task 
to prove that the classical measurement data must come exclusively from entangled p^e, i.e., 
their data is quantum correlated. 

Due to the discrete-continuous structure of the setup, we use the Expectation Value Matrix 
method l26l[32l to verify the existence of quantum correlations. In this method, all measured 
expectation values are stored in a matrix, and the separability of this matrix is linked to the 
separability of the possible underlying quantum states. For a detailed description, the reader is 
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Fig. 2. Curves show lower bounds for quantum correlations. The variance of the Stokes 
operators is normalized by the local oscillator intensity resulting in the normalized variance 
Var(S2.3)/{«Lo)- The different curves correspond to different channel transmissions rj. 
Effective entanglement is verified in the shaded areas. 



referred to Ref. 1261 . Reference 112611 also reveals a vulnerability of the protocol arising from 
an attack on the local oscillator mode. In a homodyne setup, the assumption that the local 
oscillator is a strong coherent state allows us to regard the measurement as the single-mode 
detection of the signal's quadrature [33 1. Precisely this assumption allows Eve to perform an 
intercept-resend attack which modifies the intensities of signal and local oscillator modes. Such 
an attack will not show in Bob's quadrature detection, but could lead to data which is, at best, 
classically correlated and therefore not suitable for key generation. 

To take this into account, we consider the binary signals as true two-mode states | ± a) ® 
\(Xlo) an d we regard the homodyne detection as a measurement of the quantum Stokes operators 
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The protocol gives access to the expectation values and variances of two of the Stokes operators, 
say £2 and £3. Then, a suitable Expectation Value Matrix is constructed as follows l26l : 
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Separability of the underlying state is then tested through the condition 

X(Pab) Ta > 0, 



(3) 



(4) 



(5) 



and violation of this certifies effective entanglement. The remaining Stokes operator §1 enters 
the Expectation Value Matrix through the symmetrizing step ^2^3 = (^2^3 + ^3^2) /2+ (52^3 — 
§3§2)/2 = {S2,§3,}/2 + iS\, which is instrumental to the verification process. However, due to 
practical reasons, the expectation value (Si) is not directly measured in our experiment, and 



instead, we measure the photon number in the local oscillator mode (monitor B in Fig.QJleft))- 
We now show how this detour can provide a lower bound on (Si): 
Direct calculation leads to the relation 

S^ + Sf = 2(S + 2n w n s ), (6) 

where So is defined as the total intensity n s + h^Q. Equation © contains two quantities which 
are not directly accessible in our experiment, namely So and h s . The latter is easily replaced by 
the relation 

n s = 5 (7) 

leading to 

5 1 =S (l + ^-)-|±^. (8) 
nw 2n LO 

Finally, we use the relation (So) > (nw) to arrive at the desired bound 

(§i)>l + (nw)-%^. (9) 
2{nw) 

At this point, we can directly apply the Expectation Value Matrix method to verify the existence 
of quantum correlations, using the approximation (0 instead of the actual value of (Si). Figure 
[2] shows the noise levels for different choices of input intensities, under the assumption that 
the noise is equal for both quadratures and both signal states. The variances are normalized by 
(nw) to make the results independent of the local oscillator intensity. We observe that more 
noise can be tolerated when smaller signal amplitudes are chosen. Channel losses decrease the 
tolerable excess noise for quantum-correlated data. 

3. Experimental Setup 

In this section, we first describe Alice's and Bob's optical hardware. We then separately discuss 
the detection scheme and finally explain the control software. 

3.1. Optical setup 

The optical setup of our QKD-system is shown in Fig.Q] The Alice module consists of a diode 
laser (SLT5411 from Sumitomo Electronic Industries as used in |34l ) pulsed by a self-made 
pulsed current supply. The laser pulses are approximately 100 ns long and have a wavelength 
of 1549. 3nm. The line width is 6.6GHz at -lOdB of optical power and the coherence time 
is estimated with self-homodyning to be 0.2 ns. The laser pulses are split asymmetrically in 
the LO and the signal arm. The smaller fraction is used for the signal preparation. The signal 
arm consists of a delay fiber, a Mach-Zehnder modulator for amplitude modulation, a moni- 
tor detector, and an optical attenuator. This results in a shot noise limited weak signal at the 
single photon level. In the second fiber beamsplitter (BS) the LO pulses and the signal pulses 
are spatially combined with a 500 ns time shift. Additionally, the polarization of the pulses is 
chosen orthogonal. The last component in the Alice setup is a computer controlled polarization 
controller pre-compensating the slow polarization drift in the fiber channel. 

In the Bob module the signal is demultiplexed with a polarizing beamsplitter (PBS). We 
control the second port of the PBS with a physical block to ensure the second input mode is in 
a vacuum state. The LO passes a delay fiber, while the signal is directly sent to the free-space 
detection setup. A monitor diode behind a highly reflective mirror measures the LO energy 
pulse by pulse. The polarization control is set such that the power on the monitor diode is 
maximized. Finally the signal is measured with our detection scheme shown in (Fig. [T] (right)). 



3.2. Detection System 

The detection system in Fig. [T] (right) consists of two homodyne detectors detecting two conju- 
gate quadratures of the signal mode simultaneously. This was first investigated in 136, 37l l38l . 
Our scheme consists of free-space optics and therefore allows for easy and lossless manipu- 
lations of the polarization. The LO's polarization is then chosen to be circular. The signal's 
polarization is tilted by 45° with respect to H and V polarization. Both beams interfere on a 
polarization independent 50:50 beam splitter with acute angle of incidence. 

For the H-polarized component, we label the relative phase between the signal and the bright 
LO fai = fa , where fa originates from interferometer drifts in sender and receiver modules. 
The phase shift of n/2 between two orthogonally polarized LO components results in a relative 
phase for the V-components of fa = fa + n/2. Both beams propagate to a PBS, which separates 
the H- and V-polarization. The reflected V-components impinge on the first homodyne detector 
(HD1), while the transmitted H-components impinge on the second homodyne detector (HD2). 
The difference of the photo currents is recorded. 

Commonly, homodyne detectors are treated as quadrature detectors. We calculate the photon 
number difference n_ detected by HD1 using the linearized field operators a$ = a ■ 1 + Sds 
and &LO = (*lo ' 1 + o~<5w- We assume that ollo an d Ot are real and aw ^ 01. Additionally, the 
modes S± and LO±, the modes orthogonally polarized to signal and LO, are in a vacuum state, 
i.e. d$ ± = Sds ± and az,o ± = d&io^ ■ The last assumption is justified, since the other input port of 
the PBS is under Bob's control. The detected signal is found after a straightforward calculation 
to be 

« HD1 = \{{awe^+a L o^)\a s + a S] ) (10) 

+{a s + a s± ) + (a LO e^' + a w± e">')) 
= a LO (cos(fa)-a + 8X s4l + 8X Sl ) , 

where Xm,$ — \(a M e"^ + ciMe~"^) is a quadrature operator for mode M with a phase 0. This 
quadrature measurement is derived analogously for HD2. It reads 

» HD2 = \{{&we^ Kl2 -&w^ +Kl2 )H&s-&sJ (ID 

+(a s - a s j\a w e^ 2 - a LO J^I 2 )) 

= a LO (cos(fa + n/2) ■ a + 8X s ^ I+n/2 + 8X S J . 

The vacuum input S± at the PBS adds additional 3 dB noise to the variance of the measurement. 
Therefore our setup is equivalent to a standard heterodyne detection. We do not stabilize the 
interferometric phase fa but let it drift freely. However, we have an inherent stabilization of the 
relative phase of faj — fa = n/2. Therefore two random but conjugate quadratures are measured 
with HD1 and HD2. 

The simultaneous measurement of two conjugate quadratures depends strongly on the proper 
choice of the polarization of signal and LO in the detection setup. For balancing, a linearly 
polarized LO is equally split to both homodyne detectors. A weak signal beam is then sent into 
the detection scheme. The quadrature measurements of 4000 signals are averaged and the mean 
values are plotted in the two-dimensional measurement space of Fig. |5Ja). Phase drifts of the 
interferometric phase will result in elliptical or circular graphs, depending on the angle of the 
quarter wave plate (QWP) in the LO path, corresponding to largely correlated measurements 
(elliptical) and uncorrected measurements (circular). It is easy to show, that by turning the 
QWP, two quadratures with arbitrary relative angle can be measured. We desire uncorrected 
measurements (orange trace in Fig. [2 a)). 




calibration pulse amplitudes a cg| 



Fig. 3. (a) Lissajous figure of a phase randomized signal is measured for different settings 
of the QWP in the setup. If the measured quadratures Xy and X§ are not orthogonal, the 
shape of the graph will be elliptical. We demonstrate that orthogonal quadratures are meas- 
ured for the correct QWP angle (orange trace), (b) The phase is estimated from blocks 
of calibration pulses. The figure shows the standard deviation of the phase drift between 
different calibration blocks. 



3.3. Electronics and Automatization 

In the following, we describe the electronic hardware, the control software and the steps in the 
postprocessing. The Alice electronics is essentially a 14-bit-D/A-converterto prepare the signal 
with a sampling rate of 20MS/s. One port drives the laser with a pulse rate of 1 MHz. Another 
port produces rectangular pulses for the amplitude modulator. A third port synchronizes Bob's 
experiment with an electronic clock signal at approximately 1 kHz. The clock could be substi- 
tuted for a synchronization using the LO monitor diode and calibration pulses as time stamp in 
future experiments. 

A quaternary modulation is applied to the amplitude modulator to create the states \ a), |— Of), 
\a ca i) and | — a ca i), where a is the signal amplitude and a cu \ is the amplitude of brighter "classi- 
cal" calibration pulses sent along with the signal. The pulse pattern consists of four calibration 
pulses followed by 28 signal pulses. 

To pre-compensate the polarization drift, we inserted the polarization control in Alice's setup. 
An optimal separation of signal and LO is obtained by maximizing the LO power on the monitor 
diode. The power is maximized either manually or with Bob's PC using a simplex method [35 1. 
This demultiplexing method is very stable. It is furthermore lossless as opposed to a coupler 
with fixed splitting ratio ifTBI . 

In the following, we describe the electronic circuits. The difference signal in the homodyne 
detectors is amplified by charge sensitive amplifiers as in the design by f39|. The electrical 
pulse duration produced by the detectors is set to 400 ns (foot), which allows for repetition rates 
up to 2 MHz while maintaining linear amplification. The linearity was confirmed for all four 
photodiodes independently. Due to limitations of computing power, and an electronic signal 
due to LO light leaking into the signal arm, we run the experiment at 1 MHz. When varying the 
LO power for balanced homodyne detection of vacuum, we find a linear behavior of the signal 
variance versus the LO intensity. For typical LO power of 10 8 photons/pulse, the electronic 
noise is 20 dB below the signals variance. The common mode rejection ratio is always better 
that 40 dB. The detection efficiency of the homodyne detectors was 70%, including the quantum 
efficiency of the diodes (86%), the mode matching efficiency (95.4%) and the loss in optical 
components (10%). 

Bob's 1 2-bit- A/D-converter digitizes the signal and the LO monitor detectors with 16 MS/s. 



We reduce the number of samples by neglecting samples in between the pulses Q and averaging 
8 samples (approximately the electronic pulse length). These mean values are used to estimate 
the shot noise level, as shown in Eqn. (O. In the postprocessing, we estimate the mean value 
of the Stokes operators £2 and §3 for 1024 signal states. The displacement with respect to this 
mean value is considered as quantum signal. Long term fluctuations of the detector are thereby 
compensated. 

The interferometric phase (pi is estimated with the four bright calibration pulses in each 32- 
pulse-frame. To measure the phase noise, we calculate the phase drift between two calibration 
steps. We show the standard deviation of the phase drift in Fig. Ob). We find that for weak 
calibration pulses the standard deviation depends on the calibration pulse amplitude. This stems 
from the limit for the phase estimation of weak coherent states l40l . For stronger amplitudes, 
the standard deviation of the phase drift is measured to be 4 degree for calibration times of 
32/is. With the estimated phase, we remap the coordinate system of the measured frame to the 
phase space of Alice's signal states. Subsequently, the data can be analyzed as described in the 
next section. The computational power needed for the complete postprocessing is high, but at 
1MHz repetition rate the system runs continuously in realtime, as required for practical use in 
a QKD system. 

4. Verification of Effective Entanglement 

Reformulating the measurement in the Stokes representation (see Eqns. (ffl) is of great impor- 
tance for the security analysis of the system. We find that Eqns. ( TTOb and (fTTT i have the form 
of a simultaneous Stokes measurement of the Sp- and the Sp +n /2-°P eia - to ^ respectively, where 
Sg = §2 cos + §3 sin . The Stokes operator S\ is estimated by the monitor diode, as shown in 
Eqn. ©. 

To verify the effective entanglement in our experiment, we compare the measured excess 
noise to the theoretical upper noise bounds (see Fig.|2]i. The excess noise estimation demands 
a calibration step. The standard procedure to calibrate the shotnoise level is to probe vacuum. 
Therefore, we physically block the signal arm of the detection stage and monitor the noise 
power of the Stokes measurements, as well as the signal of the LO monitor diode. The shot- 
noise estimation thus corresponds to a measurement of the electronic gains in the detection 
system using a well known and low noise light bearrQ. In standard homodyne detection, the 
variance of the shot noise will then scale with the power of the LO in following measurements. 
However, a new aspect is introduced in Eqn. ©: If there is significant noise power in the £2- or 
§3 -component of the signal states, the bound on (§1) will deteriorate, and with it the ability to 
detect quantum correlations. We estimate the contribution of the last term in Eqn. (O. We con- 
sider the worst case, i.e. the maximal reduction of the expectation value in each measurement 
run for a single amplitude (5 million signal pulses). 

ffl> , (3> ^o m J 1 *»( (12) 

(«Lo) <«Lo) yf 2 \ (ULO) J Ys 3 \ (ULO) J ' 

where )tx> and «lo are gains and output voltages of the detectors for the 5,-components 

(i = 2,3) and the LO power, respectively. The calibration measurement is used to measure the 
gain ratio. For an approximately shot noise limited beam we find 



'In a QKD system the removed samples should be checked for manipulation attacks. 

2 If the LO has traveled through the eavesdropper's regime, it is mandatory to verify that the beam exhibits small 
excess noise compared to the detector's common mode rejection ratio, e.g. with an attenuation measurement 1411 . 
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Fig. 4. Alice and Bob are connected back to back, (a) Combined Q-function generated from 
5 million pulses with amplitudes a s = 0.5 (b) Q-functions for each signal state, (c) Excess 
noise estimated from Q-function for varying signal amplitudes, (d) Average excess noise 
(circles) compared to the bounds given by the entanglement criterion (solid line), shown 
with the 3-sigma confidentiality interval (dashed lines). 
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The reduction of the normalized expectation value is fluctuating during the measurements. 
However, using Eqns. (fTSl i and (13[ . we calculated that it never surpasses 10~ 3 . This factor 
is considered by shifting the bound for the entanglement verification. Another uncertainty in 
the level of shotnoise is the estimation error of the LO power. The LO power is measured for 
every signal pulse separately and therefore has a rather large standard deviation of 6 • 10~ 3 . We 
consider the deviation by plotting the three sigma confidence interval around the upper noise 
bound. 

In our first measurement, we connected both modules back to back. The effective detection 
efficiency is therefore merely the 70% efficiency of the receiver module. The Q-functions are 
measured for the two signal states combined or separately as shown in Fig. Ua) and (b), re- 
spectively. From the Q-functions, we estimate the mean value and the variance for both Stokes 
opertors of both signal states as shown in Fig.lUc). We find that the variances are approximately 
equal. Their average variance is therefore compared to the upper bound of the variance given 
by the Expectation Value Matrix method. The comparison of upper bound and average variance 
is shown in[4|d). We find, that for all tested signal amplitudes the measured noise is below the 
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Fig. 5. Alice and Bob are connected with a 2 km optical fiber, (a) Excess noise estimated 
from Q-function measurement for varying signal amplitudes, (b) Average excess noise (cir- 
cles) compared to the bounds given by the entanglement criterion (solid line), shown with 
the 3-sigma confidentiality interval (dashed lines). 

3-sigma confidentiality interval. Therefore the effective entanglement is verified. 

We then substitute the 2 m quantum channel with a 2 km standard optical fiber. The effective 
detection efficiency was 44.8%. The transmission of the channel decreases to 64% also due 
to additional splices. In an optimized setting, this attenuation corresponds to at least 10 km of 
fiber. Again, we estimate the mean values and the variance for both Stokes opertors of both 
signal states as shown in Fig. [5ja). Finally, we compare the average values to the upper bound 
of the variance given by the Expectation Value Matrix method (Fig. |5jb)). We find that for 
signal amplitudes below 0.45, effective entanglement is verified in our system. 

5. Conclusion 

In conclusion, we present a fiber-based continuous-variable quantum key distribution system. 
We demonstrate a receiver module, which simultaneously measures conjugate Stokes operators 
of light. This is the first simultaneous detection of conjugate Stokes operator of a quantum sig- 
nal after a fiber channel. From the measured Q-function of the transmitted signal, we estimate 
the attenuation and the excess noise caused by the channel. For the measured amount of excess 
noise, the theory has not progressed far enough to generate an unconditionally secure and secret 
key. Nevertheless, we successfully witness effective entanglement with a channel length of up 
to 2 km considering both parts of the quantum signal, the signal and the LO mode. 
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